High Threat Security Alert (A26-04-34): Vulnerability in cPanel & WHM / WP2

Description:

cPanel released a security advisory to address a vulnerability in affected system. An attacker could exploit this vulnerability by sending specially crafted requests to an affected system.

Reports indicated that the proof-of-concept(PoC) exploit codes for an escalation of privilege and security restriction bypass vulnerability (CVE-2026-41940) is available. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.

Affected Systems:

• cPanel and WHM prior to version 11.86.0.41
• cPanel and WHM prior to version 11.110.0.97
• cPanel and WHM prior to version 11.118.0.63
• cPanel and WHM prior to version 11.126.0.54
• cPanel and WHM prior to version 11.130.0.18
• cPanel and WHM prior to version 11.132.0.29
• cPanel and WHM prior to version 11.136.0.5
• cPanel and WHM prior to version 11.134.0.20
• WP Squared prior to version 136.1.7

Impact:

Successful exploitation of the vulnerability could lead to escalation of privilege and security restriction bypass on an affected system.

Recommendation:

Patches for affected systems are available. System administrators of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

More Information:

• https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026
• https://www.cve.org/CVERecord?id=CVE-2026-41940